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RUSSIAN HACKERS MAY HAVE PULLED OFF WHAT COULD BE THE 
MOST DAMAGING BREACH EVER OF U.S. COMPUTER SECURITY 


By Gregory Vistica 

I t’s BEING CALLED 
“Moonlight Maze,” an ap¬ 
propriately cryptic name 
for one of the most poten- 
jj tiallydamagingbreachesof 
; l American computer security 
1 S ever—serious enough for the 

( Department of Defense to or¬ 
der all of its civilian and mili¬ 
tary employees to change their 
j computer passwords by last 
| month, the first time this pre- 
'i caution has ever been taken en 
; masse. The suspects: crack cy- 
j berspooks from the Russian 

\ Academy of Sciences, a _ 

\ government-supported 
\ oiganization that inter¬ 
im acts with Russia’s top 
l militaiy labs. The tar- j 

l gets: computer systems j 

S attheDepartmentsof j 

I Defense and Energy i 

| military contractors and lU gj 
\ leadingeivilianuniver- gjmB 
\ sides. The haul: vast | sfig 
jj quantities of data that, fSB 
l intelligence sources °lSS 


familiar with the case tell 
Newsweek, couldinclude 
classified naval codes and in¬ 
formation on missile-guid¬ 
ance systems. This was, Penta¬ 
gon officials say flatly, “a 
state-sponsored Russian intel¬ 
ligence effort to get U.S. tech¬ 
nology”—as far as is known, 
thefirstsuch attempt ever by 
Russia. Washington has not 
yet protested to Moscow. But 
DeputySecretary ofDefense 
John Hamre, who has briefed 
congressional committees on 
I the investigation, has told col- 
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~JB H Afterthat, “we’re notcertain 

|| |pl where they went,” says GOP ■ 

Si! y \kff Rep. Curt Weldon, who has 

3 held classified hearings on 

* Moonlight Maze. 

As a federal interagency 
task force begins its damage 
RF THE assessment, a key question is 

»t I nt whether the Russians man- 

RUY aged to jump from the unclas¬ 

sified (although non-public) 
systems where they made 
leagues: “We’re in the middle their initial penetration into 

ofacyberwar.” the classified Defense Depart- 

In a cyberwar, the offensive ment network that contains 

force picks the battlefield, and the most sensitive data. Ad- 

the other side may not even ministration officials insist 

realize when it’s under attack. the “firewalls” between the 

Defense Department officials networks would have pre¬ 
believe the intrusions, which vented any such intrusion, but 

they describe as “sophisticat- other sources aren’t so sure, 

ed, patient and persistent,” Besides, one intelligence offi- 
began at a low level of access cial admitted, classified data 

in January. Security sleuths often lurk in unclassified 

spotted them almost immedi- databases. With enough time 

ately and back-hacked” the and computer power, the Rus- 

source to computers inRus- sians could sift through their 

sia. Soon, though, the attack- mountains of pilfered infor- 

ers developed new tools mation and deduce those se- 
that allowed them to crets they didn’t directly steal, 

enter undetected (al- That’s one more thing to wor- 

though they sometimes ry about, although security 

left electronic traces officials admit that they have a 

that could be recon- more pressing concern. The 

structed later). Intelli- intruders haven’tbeen spot- 
gence sources say the ted on the network since May ( 

i -* 1 perpetrators even 14. Have they given up their j 

gained “root level” ac- efforts-or burrowed 

cess to some systems, a so deeply into the network 
depth usually restricted that they can no longer even I 

to a few administrators, be traced? 
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